CWE-441.

Improper Validation in Conduit-derived homeservers resulting in Unintended Proxy or Intermediary ('Confused Deputy')

• continuwuity
• CWE-441

SurrealDB Affected by Confused Deputy Privilege Escalation through Future Fields and Functions

• Broken access control
• CWE-441

<2.5.0 || >=3.0.0-alpha.1, <3.0.0-beta.3 · fixed in 2.5.0, 3.0.0-beta.3

Nuvation Energy nCloud Client-to-Client Communication

• Nuvation Energy nCloud VPN Service
• CWE-441

Nuvation Energy Multi-Stack Controller Proxy service allows arbitrary BMS access

• Nuvation Energy Multi-Stack Controller (MSC)
• CWE-441

Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries in code.gitea.io/gitea

• CWE-441

<1.22.2 · fixed in 1.22.2

Conduit-derived homeservers are affected by a Confused Deputy and Improper Input Validation issue

• continuwuity
• CWE-20
• CWE-441

Misconfigured Internal Proxy in runtimes-inventory-rhel8-operator Grants Standard Users Full Cluster Administrator Access in github.com/RedHatInsights/runtimes-inventory-operator

• CWE-441

* · no fixed version yet

In onCreateTasks of CameraActivity.java, there is a possible permission bypass due to a confused deputy.

• Google Android
• CWE-441

In validateIconUserBoundary of PrintManagerService.java, there is a possible cross-user image leak due to a confused deputy.

• Google Android
• CWE-441

In multiple locations, there is a possible way to alter the primary user's face unlock settings due to a confused deputy.

• Google Android
• CWE-441

In onActivityResult of EditFdnContactScreen.java, there is a possible way to leak contacts from the work profile due to a confused deputy.

• Google Android
• CWE-441

In multiple functions of NotificationStation.java, there is a possible cross-profile information disclosure due to a confused deputy.

• Google Android
• CWE-441

In grantAllowlistedPackagePermissions of SettingsSliceProvider.java, there is a possible way for a third party app to modify secure settings due to a confused deputy.

• Google Android
• CWE-441

In multiple locations, there is a possible way to leak audio files across user profiles due to a confused deputy.

• Google Android
• CWE-441

fastify-reply-from affected by bypass of reply forwarding

• CWE-441

<12.5.0 · fixed in 12.5.0

Rack has a Possible Information Disclosure Vulnerability

• Information disclosure
• CWE-441

<2.2.20 || >=3.0, <3.1.18 || >=3.2, <3.2.3 · fixed in 2.2.20, 3.1.18, 3.2.3

marimo vulnerable to proxy abuse of /mpl/{port}/

• CWE-441

>=0.9.20, <0.16.4 · fixed in 0.16.4

In System UI, there is a possible way to view other users' images due to a confused deputy.

• Google Android
• CWE-441

In App Widget, there is a possible Information Disclosure due to a confused deputy.

• Google Android
• CWE-441

Google Android: In AndroidManifest.xml, there is a possible way for an app to monitor motion events due…

• Google Android
• CWE-441

Google Android: In multiple locations, there is a possible leak of an image across the Android User…

• Google Android
• CWE-441

In isSystemUid of AccountManagerService.java, there is a possible way for an app to access privileged APIs due to a confused deputy.

• Google Android
• CWE-441

In markMediaAsFavorite of MediaProvider.java, there is a possible way to bypass the WRITE_EXTERNAL_STORAGE permission due to a confused deputy.

• Google Android
• CWE-441

In setRingtoneUri of VoicemailNotificationSettingsUtil.java , there is a possible cross user data leak due to a confused deputy.

• Google Android
• CWE-441

In onActivityResult of VoicemailSettingsActivity.java, there is a possible work profile contact number leak due to a confused deputy.

• Google Android
• CWE-441

In multiple functions of AppRestrictionsFragment.java, there is a possible way to bypass intent security check due to a confused deputy.

• Google Android
• CWE-441

In onCommand of ActivityManagerShellCommand.java, there is a possible arbitrary activity launch due to a confused deputy.

• Google Android
• CWE-441

In isSafeIntent of AccountTypePreferenceLoader.java, there is a possible way to bypass an intent type check due to a confused deputy.

• Google Android
• CWE-441

In validateUriSchemeAndPermission of DisclaimersParserImpl.java , there is a possible way to access data from another user due to a confused deputy.

• Google Android
• CWE-441

In getContextForResourcesEnsuringCorrectCachedApkPaths of RemoteViews.java, there is a possible way to load arbitrary java code in a privileged context due to a confused deputy.

• Google Android
• CWE-441

In loadDrawableForCookie of ResourcesImpl.java, there is a possible way to access task snapshots of other apps due to a confused deputy.

• Google Android
• CWE-441

In multiple locations, there is a possible confused deputy due to Intent Redirect.

• Google Android
• CWE-441

In onCreate of ChooserActivity.java , there is a possible way to view other users' images due to a confused deputy.

• Google Android
• CWE-441

kro Confused Deputy vulnerability in github.com/kro-run/kro

• CWE-441

<0.2.1 · fixed in 0.2.1

code-server's session cookie can be extracted by having user visit specially crafted proxy URL

• CWE-441

<4.99.4 · fixed in 4.99.4

JTEKT ELECTRONICS CORPORATION HMI ViewJet C-more series: Unintended proxy or intermediary ('Confused Deputy') issue exists in HMI ViewJet C-more…

• JTEKT ELECTRONICS CORPORATION HMI ViewJet C-more series
• JTEKT ELECTRONICS CORPORATION HMI GC-A2 series
• CWE-441

Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes

• misskey
• CWE-346
• CWE-441

Unintended Proxy or Intermediary ('Confused Deputy') in GitLab

• GitLab
• CWE-441

Mitmweb API Authentication Bypass Using Proxy Server

• Authentication bypass
• CWE-441

<11.1.2 · fixed in 11.1.2

An open proxy vulnerability affects HCL Nomad server on Domino

• HCL Software Nomad server on Domino
• CWE-441

In updateNotificationChannelFromPrivilegedListener of NotificationManagerService.java, there is a possible cross-user data leak due to a confused deputy.

• Google Android
• CWE-441

Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

• Broken access control
• CWE-441

<1.11.12 · fixed in 1.11.12

In setMediaButtonReceiver of MediaSessionRecord.java, there is a possible way to send a pending intent on behalf of system_server due to a confused deputy.

• Google Android
• CWE-441

Uncontrolled data used in content resolution

• federicoiosue Omni-Notes
• CWE-441
• CWE-610

Android: In getNumberFromCallIntent of NewOutgoingCallIntentBroadcaster.java…

• Android
• CWE-441

Metabase vulnerable to Remote Code Execution via H2

• metabase
• CWE-20
• CWE-441

Tasks.org vulnerable to data exfiltration by malicous app or adb

• tasks
• Information disclosure
• CWE-441

FileZilla Server PORT confused deputy

• FileZilla Server
• CWE-441

Jenkins Publisher Over CIFS Plugin confused deputy vulnerability

• CWE-441

<0.11 · fixed in 0.11

An unauthenticated remote attacker can use SMA 100 as an unintended proxy or intermediary undetectable proxy to bypass firewall rules.

• SonicWall SMA100
• CWE-441

Confused Deputy in Kubernetes

• CWE-441
• CWE-610

<=1.22.2 · no fixed version yet

Confused Deputy in Kubernetes

• CWE-441
• CWE-610

<=1.22.2 · no fixed version yet

ExternalName Services can be used to gain access to Envoy's admin interface

• CWE-441
• CWE-610

<1.14.2 || >=1.15.0, <1.15.2 || >=1.16.0, <1.16.1 || >=1.17.0, <1.17.1 · fixed in 1.14.2, 1.15.2, 1.16.1, 1.17.1

Confused deputy attack in sandbox module resolution

• racket
• CWE-441

Externally Controlled Reference to a Resource in Another Sphere and Confused Deputy in Spring Cloud Netflix

• CWE-441
• CWE-610

>=2.2.0, <2.2.4 || >=2.1.0, <2.1.6 · fixed in 2.2.4, 2.1.6

Loopback bypass in Coturn

• coturn
• CWE-441
• CWE-682

ELOG: ELOG 3.1.4-57bea22 and below can be used as an HTTP GET request proxy when…

• ELOG
• CWE-441

Cisco DNA Center Unintended Proxy Via SWIM Import Interface Vulnerability

• Cisco Digital Network Architecture Center (DNA Center)
• CWE-441

Tenable MikroTik RouterOS: MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an…

• Tenable MikroTik RouterOS
• CWE-441